1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
|
# /etc/ipsec.d/oe-authnull.conf
#
# Example file for Opportunstic Encryption using Auth NULL
# During negotiation, hold traffic. On IKE Auth NULL failure, fail open
# Traffic is held until IKE has failed or succeeded
# Because it uses Auth NULL, there is no protection against active MITM attacks
#
# See also oe-upgrade-authnull.conf
conn clear
type=passthrough
# temp workaround
#authby=never
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%group
auto=route
conn clear-or-private
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
negotiationshunt=hold
failureshunt=passthrough
ikev2=insist
# add, not route - because this policy is only for incoming IKE packets
auto=add
conn private-or-clear
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
negotiationshunt=hold
failureshunt=passthrough
ikev2=insist
auto=route
keyingtries=1
retransmit-timeout=2s
conn private
type=tunnel
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%opportunisticgroup
negotiationshunt=hold
failureshunt=drop
ikev2=insist
auto=route
conn block
type=reject
# temp workaround
#authby=never
authby=null
leftid=%null
rightid=%null
left=%defaultroute
right=%group
auto=route
|
